CVE-2024-53943

An issue was discovered in NRadio N8-180 NROS-1.9.2.n3.c5 devices

Medium · published February 3, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
23.1
In the wild
Unconfirmed
What it is

An issue was discovered in NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vulnerable to XSS via the 2.4 GHz and 5 GHz name parameters, allowing an attacker to execute JavaScript within the context of the current user by injecting JavaScript into the SSID field. If an administrator logs into the device, the injected script runs in their browser, executing the malicious payload.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00314 · 23.1th percentile
Published
2025-02-03T00:00Z
EPSS history
Timeline
  • 03 FEB 00:00Z
    An issue was discovered in NRadio N8-180 NROS-1.9.2.n3.c5 devices
    cvelistv5